home

www.tournowbits.com

Domain Information

Server location:
Oregon, United States (US)

ASN:
AS16509 AMAZON-02 - Amazon.com, Inc., US

Root domain:
tournowbits.com

Scanner detections:
Detections  (67% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.OpenCandy.Installer (L)
100.00%

Kaspersky
not-a-virus:AdWare.Win32.OpenCandy
100.00%

ESET NOD32
Win32/OpenCandy.A potentially unsafe application
50.00%

NANO AntiVirus
Riskware.Win32.OpenCandy.dyofpx
50.00%

ESET NOD32
Win32/OpenCandy.A potentially unsafe (variant)
50.00%

avast!
NSIS:Relevant-G [PUP]
50.00%

Avira AntiVirus
PUA/OpenCandy.Gen
50.00%

Vba32 AntiVirus
AdWare.OpenCandy
50.00%

G Data
Win32.Application.OpenCandy
50.00%

AVG
Generic
50.00%

Qihoo 360 Security
HEUR/QVM06.1.0000.Malware.Gen
50.00%

The domain www.tournowbits.com has been seen to resolve to the following 11 IP addresses.

52.25.41.73
ec2-52-25-41-73.us-west-2.compute.amazonaws.com
May 16, 2016

52.24.26.116
ec2-52-24-26-116.us-west-2.compute.amazonaws.com
May 16, 2016

54.148.57.212
ec2-54-148-57-212.us-west-2.compute.amazonaws.com
April 16, 2016

54.69.198.37
ec2-54-69-198-37.us-west-2.compute.amazonaws.com
April 16, 2016

52.26.95.11
ec2-52-26-95-11.us-west-2.compute.amazonaws.com
April 16, 2016

52.35.10.15
ec2-52-35-10-15.us-west-2.compute.amazonaws.com
April 12, 2016

52.34.170.106
ec2-52-34-170-106.us-west-2.compute.amazonaws.com
April 12, 2016

52.25.23.136
ec2-52-25-23-136.us-west-2.compute.amazonaws.com
April 12, 2016

54.191.37.5
ec2-54-191-37-5.us-west-2.compute.amazonaws.com
April 12, 2016

54.69.11.66
ec2-54-69-11-66.us-west-2.compute.amazonaws.com
April 12, 2016

52.88.159.85
ec2-52-88-159-85.us-west-2.compute.amazonaws.com
April 12, 2016

File downloads found at URLs served by www.tournowbits.com.

3 / 68      (PUP)
http://www.tournowbits.com/c?x=Z/LB555cdWuC5o8XO4FCnUyOsSMcWxg9QMlGVDoFLTo=&c=ncEzJ9RBX6u7 BGq4dg9BQQoG8 X3xU94tra4Tc7dxC5V00xyFeCe6ByFQOPshvIpZ9U3yO2mgb90yYBuM PPhpgmah8QGFpw/EWb66c53QGGNaRxgt4UZehcPG4mzm&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe  (9b039f5c2fa72613a002f343b482cfd8)

10 / 68    (PUP)
http://www.tournowbits.com/c?x=Z/LB555cdWuC5o8XO4FCnUyOsSMcWxg9QMlGVDoFLTo=&c=ncEzJ9RBX6u7 BGq4dg9BQQoG8 X3xU94tra4Tc7dxC5V00xyFeCe6ByFQOPshvIpZ9U3yO2mgb90yYBuM PPhpgmah8QGFpw/EWb66c53QGGNaRxgt4UZehcPG4mzm&downloadAs=FreeWiFiHotspot.exe&fallback_url=http://www.downloadonic.com/free-wifi-hotspot.com/.../FreeWiFiHotspot_IS.exe  (83c91819b500c48f6785e2b564a0969f)

0 / 68
http://www.tournowbits.com/WVl6OTRQVFV5V1Zad1RsQkRSWFYxZUdSamFHTTVTMUpQYUUxV1NHeFZlVEJETm14eFNVZGtTSEZsVWsxME9VMGxNMFFtWXoxdUpUSkNjV3BKTjJoNGJqaDVVRTgySlRKR1UycEZkSEE0VFhkTE1GUjZhWHBrVFdRM0pUSkdUR3M1ZG1NeFdFdDRWM0UwU0ZkdmRFSTRSMjU1YUdGNmRIbE1TVk5UT0Vab1dHSmpXVVVsTWtaVFRGUkdibE5WYURkbE5URlhUMGhLSlRKQ09WcDJObEkzTVVoWldURjBkMVJ6YWswbE1rSnpla0U0Y0UxMFRtUTRlVTV0UWpGaE1tVTRkU1prYjNkdWJHOWhaRUZ6UFZCdmQyVnlVMjkxYm1SRlpHbDBiM0pHY21WbExtVjRaU1ptWVd4c1ltRmphMTkxY213OWFIUjBjQ1V6UVNVeVJpVXlSbmQzZHk1a2IzZHViRzloWkc5dWFXTXVZMjl0SlRKR1puSmxaUzF6YjNWdVpDMWxaR2wwYjNJdVkyOXRKVEpHWm1sc1pYTmtiM2R1Ykc5aFpDVXlSbEJ2ZDJWeVUyOTFibVJGWkdsMGIzSkdjbVZsWDBsVExtVjRaUT09  (powersoundeditorfree.zip)

The following 6 files have been seen to comunicate with www.tournowbits.com in live environments.

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
online-guardian-v2.0.9.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
036629fbd4864725737a8ba8fe7e8cd6.exe

TCP » 52.24.26.116:443
rlvknlg.exe (Relevant-Knowledge by TMRG)

TCP » 52.24.26.116:443
Proxomitron.exe (Proxomitron by Groom-A-Zebu (tm))

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.